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| MEMORANDUM FOR: Director of Data Processing | REGIST 


Director of Security 

Director of Communications _£G4 puanpt uupa "4 oh 
Director of SIGINT. Operations 

Chief, Logistics § Procurement Law ie OGC 


FROM: _ James H. McDonald 
Director of Logistics 


_ SUBJECT: 7 Procurement of ADPE of Foreign Manufacture 


1. This memorandum includes in paragraph 4 a specific 
request for action and involvement by your office. 


2. The Office of Data Processing, in a 21 April 1981 
memorandum from the Chief of its Management Staff to the 
Chief of Procurement Division, OL, proposed that the following 
procurement policy be established: 


"It is the policy of the Office of Data Processing that 
automatic data processing equipment which is substantially of 
foreign manufacture will not be procured for use in Office of 
Data Processing computer networks." 


The above policy proposal was based on concerns that equipment 

could be altered for surveillance or disruptive purposes during 
manufacture; the possible embargo of spares, upgrades, engineering 
changes, servicing and follow-on technology; alteration of equip- 

ment for surveillance or disruptive purposes during servicing; ee 
difficulty in accessing engineering/manufacturing personnel; 

and, finally, the undesirable necessity of having to utilize 

foreign nationals for maintenance of hardware/software. The 


concerns expressed by ODP are supported in a June 1981 memorandum 
from[ Chief of the Office of Security's 
Information Systems Security Group. 


3. The need for stringent security with regard to the 
Agency's automated systems is paramount; however, there are a 
number of concerns which must be resolved before we implement 
the proposed policy. These include such matters as excluding 
any number of suppliers from competition for Agency business, 
cutting ourselves off from advances in technology by foreign 
manufacture, noncompliance with the Brooks Bill which is the 
"bible" for management of ADPE acquisition in Federal Government, 
what apparatus is necessary within CIA to manage such a policy, 


ens 


~what additional requirements should be placed on domestic 


suppliers to make certain that the kind of intrusion we are 
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protecting against from foreign suppliers does not occur by 
infiltration of domestic supplier ranks, etc. To fully 
identify the threat, work out the various problems, develop 

an Agency Headquarters Regulation, and establish an Agency 
organization for implementing the new policy, I believe 

that a task force should be established. Representatives 

of the addressee components are considered to have significant 
interest in this matter. The urgency of getting on with this 
effort is critical, as several large ADPE procurements are 
scheduled to occur during the next several months. 


4, It is requested that addressees designate an officer 
from their respective components to serve on a task force to 
consider the entire problem of procurement of ADPE of foreign 
manufacture. Their goal will be to recommend an Agency policy 
to me, draft a Headquarters Regulation, identify any necessary 
actions with outside parties, such as Congressional Oversight, 
National Security Council, notice in the Federal Register, etc., 
and recommend organizational changes necessary to implement 
the provisions of the Headquarters Regulation. The name of 
your designee is requested by 28 August 1981. I will ask the 
task force to attempt to complete its work by 16 October 1981. 


Because of the importance of this project, I have assigned the 
Chief of my Procurement Management Staff, | | who STAT 
will report directly to me in his role as Tas orce airman. 


Readers of this memorandum are asked to consider its content as 
sensitive and for internal use only until: such time as the task 
force has completed its work. Handling of the information on 
this basis will reduce correspondence, protests, or other commun- 
ication from outside suppliers that would be disruptive to task 
force efforts. 


/s/ James H. McDonald 
James H. McDonald 


Atts : 
A - C/MS/ODP memo dtd 21 April 81 
B - ISSG/OS memo dtd 9 June 81 


cc: General Counsel 
DDA : 
DDS&T 
DDO 
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MEMORANDUM FOR: Chief, Procurement Division, . 
Office of Logistics , 


i 
lef, Management Staff, ODP 


SUBJECT > Automatic Data Processing Equipment 
-v,- Procurement Police 


fe (U) _ 


1 
I 


1. Automatic data processing equipment (ADPE) manufactured 
in a foreign country is becoming more and more common in the 
umerican marketplace and, hence, senior ODP managers are becoming 
“mereasinaly concerned, for security reasons, about the possible 
troduction of foreign made ADPE into Central Intelligence. 
Agency facilities. Two primary reasons for these concerns are 
ohysical security considerations and the potential requirement 
“Or visits to Central Intelligence Agency facilities by 
“epresentatives of foreign vendors such as manufacturing 
engineers. New equipment will use technology that will make 
cetection of surveillance devices very difficult and thus 
inerease the possibility of a successful'penetration:of our 
“curity safeguards. When difficult, complex engineéring | 
ecoblems are encountered with ADPE manufactured in U. S., it 
vsually is possible and sometimes necessary to bring design 
“ngineers to Headquarters to resolve the problems. However, it 
vould not seem prudent to bring design engineers of foreign 
nanufactured equipment into Agency buildings. Our security | 
“oncerns, then include: a 


° Alteration of equipment for surveillance or 
disruptive purposes during manufacture. 

° Embargo of spares, upgrades, engineering 
chances, or follow-on technology. 


®° Alteration of equipment for surveillance or 
disruptive purposes during service t 
(including modification of TEMPEST |. | 
equipment). z 
’ 
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. Possibility of having to utilize foreign — 
national engineering/manufacturing’ : : 
specialists for maintenance of © ae 
hardware/software. (C) ies 
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Hn’ 2. mapeeee es for security reasons, and with the © 
concurrence of the Chief, Information Systems Security Group, 
Office of Security, we propose to establish the! following policy 
cegeeding the procurement of ADPE for use in Office of Data 

Processing computing pact cress.: oie da ee 
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. "It is. the policy of ‘the Officd ‘of: Data - 
Processing that automatic data: processing ee 
equipment which is substantially: of foreign 
manufacture will not be procured for use in ‘ 
Office of Data Processing computer a 7 
networks." (U) ae 3 a si 
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Do you have any. suggestions, for procurement reasons, 
that would Strengthen this policy? (U) : 
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